https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562550#M195654 <P>8/4/21 is not older than 7/30/21</P><P>Can you share some of your raw events as it doesn't look like your transaction command is working.</P> Mon, 09 Aug 2021 07:58:41 GMT ITWhisperer 2021-08-09T07:58:41Z https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562397#M195600 <P>Hi all, i have a query for transaction,</P><PRE>source="abc_data1_*" index="testing" sourcetype="_json" | transaction startswith=(STATUS="FAIL") endswith=(STATUS="SUCCESS")</PRE><P>The events in the results are considered from most recent to oldest. But i want this&nbsp; transaction to consider the the older data first to the processing. I want the data to be sorted from the beginning and then apply the transaction. "Reverse" doesn't work with this.Anyone knows how to do this?</P> Fri, 06 Aug 2021 09:30:39 GMT https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562397#M195600 anooshac 2021-08-06T09:30:39Z https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562410#M195607 <LI-CODE lang="markup">| sort 0 _time</LI-CODE> Fri, 06 Aug 2021 12:12:04 GMT https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562410#M195607 ITWhisperer 2021-08-06T12:12:04Z https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562425#M195611 <P>Hi sir, I am getting the events like this. only one event is older and the rest is new data.<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2021-08-06_19h54_34.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15454i9C333DAF8BDE1F76/image-size/large?v=v2&amp;px=999" role="button" title="2021-08-06_19h54_34.png" alt="2021-08-06_19h54_34.png" /></span></P><P>As you can see only first event is older.</P> Fri, 06 Aug 2021 14:29:24 GMT https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562425#M195611 anooshac 2021-08-06T14:29:24Z https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562428#M195613 <P>What is your full search?</P> Fri, 06 Aug 2021 15:01:53 GMT https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562428#M195613 ITWhisperer 2021-08-06T15:01:53Z https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562429#M195614 <P>Have you tried&nbsp;<A title="link to Tail documentation in docs.splunk.com" href="https://docs.splunk.com/Documentation/Splunk/8.2.1/SearchReference/Tail" target="_blank" rel="noopener">Tail</A>&nbsp;?</P> Fri, 06 Aug 2021 15:09:36 GMT https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562429#M195614 sharynh 2021-08-06T15:09:36Z https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562523#M195636 <PRE>source="abc_data1_*" index="testing" sourcetype="_json" | transaction startswith=(STATUS="FAIL") endswith=(STATUS="SUCCESS")</PRE><P>&nbsp;This is only my full search.</P> Mon, 09 Aug 2021 04:40:11 GMT https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562523#M195636 anooshac 2021-08-09T04:40:11Z https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562530#M195642 No. How exactly should i use that? Mon, 09 Aug 2021 05:13:17 GMT https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562530#M195642 anooshac 2021-08-09T05:13:17Z https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562550#M195654 <P>8/4/21 is not older than 7/30/21</P><P>Can you share some of your raw events as it doesn't look like your transaction command is working.</P> Mon, 09 Aug 2021 07:58:41 GMT https://community.splunk.com/t5/Splunk-Search/how-to-make-transaction-to-consider-the-data-from-the-beginning/m-p/562550#M195654 ITWhisperer 2021-08-09T07:58:41Z